> **?? DEPRECATED (2026-07-04)**: This document is superseded by [TOOLING_MAP.md](TOOLING_MAP.md). References old sysd-engine architecture and 4-node types. Kept for historical reference only.

---

> [!CAUTION]
> **⚠️ PARTIALLY STALE — Use with extreme caution ⚠️**
>
> This document was written for the original S3RV1C3agent Bash engine, now replaced by the C++ Engine (669427-engine).
> **Known stale content:**
> - Engine bind address listed as `0.0.0.0:8301` — SERVICES.md says `127.0.0.1:8301` (verify actual deployment)
> - Only lists 4 node types — missing DNS, Proxy, Filter, Engine, Vault (see `NODE_REGISTRY.md` for all 8 nodes)
> - Crypto wallet sections (XMR, USDT, USDC) — **removed 2026-06-16**, do not deploy
> - API endpoints may differ from current Engine implementation (see `SERVICES.md` §5)
>
> For current node information, see `NODE_REGISTRY.md`.
> For current architecture, see `SERVICES.md`.

# NoName eCommerce — Mesh Network Tool Map

**Version:** 4.1.0
**Last Updated:** 2026-06-18
**Classification:** INFRASTRUCTURE REFERENCE
**Scope:** All nodes (Shield, Origin, Payment, Supplement nodes)

---

## Table of Contents

1. [Overview](#1-overview)
2. [Tool Categories](#2-tool-categories)
   - [2.1 C++ Engine Binary](#21-c-engine-binary)
   - [2.2 Core Bash Scripts](#22-core-bash-scripts)
   - [2.3 Mail / Communication Tools](#23-mail--communication-tools)
   - [2.4 Service Management Tools](#24-service-management-tools)
   - [2.5 Mesh Network Tools](#25-mesh-network-tools)
   - [2.6 PHP API Handlers (Public Site)](#26-php-api-handlers-public-site)
   - [2.7 PHP Dashboard Core](#27-php-dashboard-core)
   - [2.8 Security Systems](#28-security-systems)
   - [2.9 Ghost Tools (Encrypted)](#29-ghost-tools-encrypted)
   - [2.10 Wallet Services](#210-wallet-services)
   - [2.11 Vault System](#211-vault-system)
   - [2.12 systemd Services](#212-systemd-services)
   - [2.13 Nginx Configurations](#213-nginx-configurations)
3. [Dependency Graph](#3-dependency-graph)
4. [Execution Chain](#4-execution-chain)
5. [Quick Reference Table](#5-quick-reference-table)
6. [Security Notes](#6-security-notes)

---

## 1. Overview

This document catalogs every tool, script, binary, service, and configuration artifact
in the NoName eCommerce mesh network. Each entry includes type, purpose, usage, dependencies,
node assignments, and permission requirements.

**Node types in this mesh:**

| Node      | Role                                         |
|-----------|----------------------------------------------|
| Shield    | Central command, fleet relay, audit, vault   |
| Origin    | Public storefront, dashboard, API gateway    |
| Payment   | Payment processing, wallets, bridge          |
| Supplement| Additional spoke / worker nodes              |

---

## 2. Tool Categories

### 2.1 C++ Engine Binary

#### sysd-engine

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `/usr/local/sbin/sysd-engine`                                |
| **Type**        | Binary (C++ daemon, PIE, RELRO, stack-protector, FORTIFY_SOURCE) |
| **Version**     | v4.0.0                                                       |
| **Size**        | 296 KB                                                       |
| **Build Dir**   | `/opt/apache/engine/build-v2/`                               |
| **Disguise**    | `argv[0]` rewrites to `systemd-nscd` at runtime              |
| **Listen**      | `0.0.0.0:8301` (HTTP API)                                    |
| **Nodes**       | All nodes                                                    |
| **Permissions** | `root:root`, `0750`                                          |

**Subsystems:**

| Subsystem | Name        | Purpose                                            |
|-----------|-------------|-----------------------------------------------------|
| ThreadPool| Thread pool | Worker thread management for concurrent request handling |
| HbMgr     | Heartbeat   | Generates and sends node health heartbeats          |
| WdMgr     | Watchdog    | Monitors subsystem health, triggers recovery         |
| DdMon     | DDoS monitor| Traffic anomaly detection and rate-limit enforcement |
| FoMgr     | Failover    | Automatic failover coordination between mesh nodes   |
| ScMgr     | Scripts     | Remote script execution and lifecycle management     |
| FwMgr     | Firewall    | Dynamic firewall rule management (iptables/nftables) |
| LdMgr     | Lockdown    | Emergency lockdown — isolates node on breach detection |

**API Endpoints (port 8301):**
- `/health` — Node health status
- `/heartbeat` — Mesh heartbeat submission
- `/exec` — Whitelisted command execution (via ScMgr)
- `/firewall` — Firewall rule mutations (via FwMgr)
- `/lockdown` — Emergency lockdown trigger (via LdMgr)
- `/failover` — Failover state transitions (via FoMgr)

**Dependencies:** `libssl`, `libcrypto`, `libpthread`, `iptables` (or `nftables`)
**Invoked by:** `hello --start-engine` phase

---

### 2.2 Core Bash Scripts

All core scripts are installed on **every node** in the mesh.

#### hello

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `/opt/apache/tools/hello`                                    |
| **Type**        | Bash script                                                  |
| **Purpose**     | Node initialization — 3-phase startup gate                   |
| **Permissions** | `root:root`, `0750`                                          |

**Usage:**

```bash
hello --verify-mesh    # Phase 1: Verify mesh connectivity and node identity
hello --load-routes    # Phase 2: Load network routes, firewall rules, service configs
hello --start-engine   # Phase 3: Start sysd-engine daemon
```

**Behavior:**
- All 3 phases must complete successfully. Failure at any phase triggers **hard lockdown** (Rule 3).
- Phase 1 validates node certificate and mesh peer reachability.
- Phase 2 applies routing tables and firewall baseline.
- Phase 3 forks `sysd-engine` via `systemctl start sysd-engine`.

**Dependencies:** `openssl`, `iproute2`, `iptables`, `systemctl`, `sysd-engine`

---

#### s3rv1c3agent

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `/opt/apache/tools/s3rv1c3agent`                             |
| **Type**        | Bash script (persistent daemon)                              |
| **Purpose**     | Persistent Shield agent — heartbeat + whitelisted command execution |
| **PID File**    | Unique per node (e.g., `/var/run/sysc-engine/s3rv1c3agent.pid`) |
| **Permissions** | `root:root`, `0750`                                          |

**Behavior:**
- Opens persistent connection to Shield for heartbeat reporting.
- Accepts commands from Shield; validates against **whitelist** only.
- All commands require **HMAC-SHA256 validation** before execution.
- Uses `constant_time_equal` function for timing-safe HMAC comparison (prevents timing side-channels).
- Command dispatch uses hardened `case` statement mapping (no `eval`, no command injection path).
- **Terminates immediately on any `hello` failure** (Rule 4 — lifecycle dependency).
- Auto-restarts via `systemd` or `hello` phase 3.

**Dependencies:** `openssl`, `curl`, `sysd-engine`, `hello`

---

#### img-pipeline.sh

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `/opt/apache/tools/img-pipeline.sh`                          |
| **Type**        | Bash script                                                  |
| **Purpose**     | Image processing pipeline for product/asset images           |
| **Interval**    | Run by `s3rv1c3agent` every 10 seconds                       |
| **Permissions** | `root:root`, `0750`                                          |

**Pipeline steps:**
1. **EXIF/ICC strip** — Remove all metadata via `exiftool` or `convert -strip`
2. **Resize** — Generate 400x400 (thumbnail) and 800x800 (preview) variants
3. **WebP generation** — `cwebp -q 85` for compressed web delivery
4. **URL obfuscation** — Rename file to random hash, map in database
5. **DB mapping** — Insert `original -> obfuscated` mapping into asset database

**Dependencies:** `ImageMagick` (or `exiftool`), `cwebp`, `mysql`/`sqlite3` client
**Called by:** `s3rv1c3agent` (10s cron loop)

---

#### se_client.sh

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `/opt/apache/tools/se_client.sh`                             |
| **Type**        | Bash script (library, sourced — not executed directly)       |
| **Purpose**     | Shared client utility functions                              |
| **Consumers**   | Sourced by 8+ mail tools (askmail, cmdmail, dbwrite, etc.)   |
| **Permissions** | `root:root`, `0640`                                          |

**Typical functions:**
- `hmac_sign()` — HMAC-SHA256 signing for outbound requests
- `api_call()` — Standardized HTTP client with timeout and retry
- `log_event()` — Structured logging with severity levels
- `read_config()` — Secure config file parser (no eval)

**Dependencies:** `openssl`, `curl`, `jq`

---

### 2.3 Mail / Communication Tools

All located in `/opt/apache/tools/`. All are bash scripts.
All mail tools source `se_client.sh` for shared authentication and transport.

#### askmail

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `/opt/apache/tools/askmail`                                  |
| **Type**        | Bash script                                                  |
| **Purpose**     | HMAC-secured mail query — send query to Shield mail API      |
| **HMAC Method** | `openssl dgst -sha256 -binary | xxd -p`                      |
| **Nodes**       | All nodes                                                    |
| **Permissions** | `root:root`, `0750`                                          |

**Usage:** `askmail --to <recipient> --subject <subject> --body <file>`

**Dependencies:** `openssl`, `curl`, `se_client.sh`

---

#### cmdmail

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `/opt/apache/tools/cmdmail`                                  |
| **Type**        | Bash script                                                  |
| **Purpose**     | Mail command dispatcher — routes mail-related commands       |
| **Nodes**       | All nodes                                                    |
| **Permissions** | `root:root`, `0750`                                          |

**Usage:** `cmdmail <command> [args...]` — dispatches to sub-mail tools

**Dependencies:** `askmail`, `getmail`, `logmail`, `se_client.sh`

---

#### dbwrite

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `/opt/apache/tools/dbwrite`                                  |
| **Type**        | Bash script                                                  |
| **Purpose**     | Database write utility — inserts mail/audit records          |
| **Nodes**       | All nodes                                                    |
| **Permissions** | `root:root`, `0750`                                          |

**Usage:** `dbwrite --table <table> --data <json>`

**Dependencies:** `mysql` client (or `sqlite3`), `se_client.sh`

---

#### getmail

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `/opt/apache/tools/getmail`                                  |
| **Type**        | Bash script                                                  |
| **Purpose**     | Mail retrieval — fetches mail from Shield mail queue         |
| **Nodes**       | All nodes                                                    |
| **Permissions** | `root:root`, `0750`                                          |

**Usage:** `getmail --since <timestamp> --limit <n>`

**Dependencies:** `curl`, `jq`, `se_client.sh`

---

#### logmail

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `/opt/apache/tools/logmail`                                  |
| **Type**        | Bash script                                                  |
| **Purpose**     | Mail logging — records mail send/receive events to audit DB  |
| **Nodes**       | All nodes                                                    |
| **Permissions** | `root:root`, `0750`                                          |

**Usage:** `logmail --event <send|receive> --mail-id <id> --status <ok|fail>`

**Dependencies:** `dbwrite`, `se_client.sh`

---

#### mailcli

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `/opt/apache/tools/mailcli`                                  |
| **Type**        | Bash script                                                  |
| **Purpose**     | Interactive mail CLI client for admin debugging              |
| **Nodes**       | Shield, Origin                                               |
| **Permissions** | `root:root`, `0750`                                          |

**Usage:** `mailcli` — interactive prompt for mail operations

**Dependencies:** `askmail`, `getmail`, `cmdmail`, `se_client.sh`

---

#### mailctl

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `/opt/apache/tools/mailctl`                                  |
| **Type**        | Bash script (daemon)                                         |
| **Purpose**     | Mail control daemon — manages mail queue and relay state     |
| **PID File**    | `/var/run/sysc-engine/mailctl.pid`                           |
| **Auth**        | HMAC verification on all control commands                    |
| **Timing Safe** | Uses `constant_time_equal` for HMAC comparison               |
| **Nodes**       | Shield, Origin                                               |
| **Permissions** | `root:root`, `0750`                                          |

**Usage:** `mailctl {start|stop|status|flush|reload}`

**Dependencies:** `openssl`, `curl`, `s3rv1c3agent`, `se_client.sh`

---

#### paymail

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `/opt/apache/tools/paymail`                                  |
| **Type**        | Bash script                                                  |
| **Purpose**     | Payment notification mailer — sends payment status emails    |
| **Nodes**       | Payment node, Shield                                         |
| **Permissions** | `root:root`, `0750`                                          |

**Usage:** `paymail --order-id <id> --status <paid|failed|pending>`

**Dependencies:** `askmail`, `se_client.sh`

---

#### pollmail

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `/opt/apache/tools/pollmail`                                 |
| **Type**        | Bash script (daemon)                                         |
| **Purpose**     | Mail polling daemon — polls external mail sources for new messages |
| **Nodes**       | Shield, Origin                                               |
| **Permissions** | `root:root`, `0750`                                          |

**Usage:** `pollmail --interval <seconds> --source <imap|api>`

**Dependencies:** `curl`, `openssl`, `se_client.sh`

---

#### unmail

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `/opt/apache/tools/unmail`                                   |
| **Type**        | Bash script                                                  |
| **Purpose**     | Mail cleanup / undo — removes sent mail from queue, revokes  |
| **Nodes**       | All nodes                                                    |
| **Permissions** | `root:root`, `0750`                                          |

**Usage:** `unmail --mail-id <id> [--force]`

**Dependencies:** `dbwrite`, `se_client.sh`

---

### 2.4 Service Management Tools

All `svc*` tools are bash scripts on **all nodes**, prefix `svc`.

#### svcbeat

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `/opt/apache/tools/svcbeat`                                  |
| **Type**        | Bash script                                                  |
| **Purpose**     | Service heartbeat sender — emits heartbeat to Shield monitor |
| **Permissions** | `root:root`, `0750`                                          |

**Usage:** `svcbeat --service <name> --status <up|down|degraded>`

**Dependencies:** `curl`, `openssl` (HMAC)

---

#### svcboot

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `/opt/apache/tools/svcboot`                                  |
| **Type**        | Bash script                                                  |
| **Purpose**     | Service boot coordinator — ordered parallel service startup  |
| **Permissions** | `root:root`, `0750`                                          |

**Usage:** `svcboot --profile <profile.json>` — starts services in dependency order

**Dependencies:** `svcbeat`, `systemctl`, `jq`

---

#### svccfg

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `/opt/apache/tools/svccfg`                                   |
| **Type**        | Bash script                                                  |
| **Purpose**     | Service configuration manager — read/write service configs   |
| **Permissions** | `root:root`, `0750`                                          |

**Usage:** `svccfg {get|set|reload} <service> <key> [value]`

**Dependencies:** `jq`, `sed`

---

#### svcfile

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `/opt/apache/tools/svcfile`                                  |
| **Type**        | Bash script                                                  |
| **Purpose**     | Service file operations — secure copy/move/delete for service data |
| **Permissions** | `root:root`, `0750`                                          |

**Usage:** `svcfile {copy|move|delete} <src> <dst> [--verify-checksum]`

**Dependencies:** `sha256sum`, `cp`, `mv`

---

#### svcfw

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `/opt/apache/tools/svcfw`                                    |
| **Type**        | Bash script                                                  |
| **Purpose**     | Service firewall rules — dynamic iptables/nftables rule management |
| **Permissions** | `root:root`, `0750`                                          |

**Usage:** `svcfw {add|remove|list} --chain <chain> --rule <spec>`

**Dependencies:** `iptables` (or `nftables`), `sysd-engine` (FwMgr API)

---

#### svclock

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `/opt/apache/tools/svclock`                                  |
| **Type**        | Bash script                                                  |
| **Purpose**     | Service lock management — `flock`-based exclusive locks      |
| **Lock Dir**    | `/var/lock/sysc-engine/`                                     |
| **Permissions** | `root:root`, `0750`                                          |

**Usage:** `svclock {acquire|release|status} <lockname> [timeout]`

**Dependencies:** `flock`, `bash`

---

#### svclog

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `/opt/apache/tools/svclog`                                   |
| **Type**        | Bash script                                                  |
| **Purpose**     | Service log rotation and aggregation — compress, ship, archive |
| **Permissions** | `root:root`, `0750`                                          |

**Usage:** `svclog {rotate|ship|status} --service <name>`

**Dependencies:** `gzip`, `logrotate`, `rsync` (for shipping)

---

#### svcpass

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `/opt/apache/tools/svcpass`                                  |
| **Type**        | Bash script                                                  |
| **Purpose**     | Service password / credential rotation                       |
| **Permissions** | `root:root`, `0700`                                          |

**Usage:** `svcpass rotate --service <name> [--notify]`

**Dependencies:** `openssl rand`, `vault` (key retrieval)

---

#### svcperm

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `/opt/apache/tools/svcperm`                                  |
| **Type**        | Bash script                                                  |
| **Purpose**     | Service permission manager — enforces least-privilege file perms |
| **Permissions** | `root:root`, `0750`                                          |

**Usage:** `svcperm apply --profile <perm.json> --path <dir>`

**Dependencies:** `chmod`, `chown`, `find`, `jq`

---

#### svcrotate

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `/opt/apache/tools/svcrotate`                                |
| **Type**        | Bash script                                                  |
| **Purpose**     | Service key and certificate rotation                         |
| **Permissions** | `root:root`, `0700`                                          |

**Usage:** `svcrotate {tls|ssh|api-key} --service <name> [--auto-renew]`

**Dependencies:** `openssl`, `certbot` (optional), `svcpass`

---

#### svctrap

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `/opt/apache/tools/svctrap`                                  |
| **Type**        | Bash script                                                  |
| **Purpose**     | Canary / trap file deployment — honeypot file monitoring     |
| **Permissions** | `root:root`, `0750`                                          |

**Usage:** `svctrap deploy --path <dir> [--count <n>]` — deploys decoy files with monitoring

**Behavior:** Creates canary files; alerts Shield on any read/write access.

**Dependencies:** `inotifywait` (inotify-tools), `svcbeat`

---

### 2.5 Mesh Network Tools

#### mesh_heartbeat.sh

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `/opt/apache/tools/mesh_heartbeat.sh`                        |
| **Type**        | Bash script                                                  |
| **Purpose**     | Inter-node heartbeat — HMAC-SHA256 mesh health checks        |
| **Interval**    | Continuous (daemon loop, typically 30s)                      |
| **Nodes**       | All nodes                                                    |
| **Permissions** | `root:root`, `0750`                                          |

**Behavior:**
- Sends HMAC-SHA256 signed heartbeat to all known mesh peers.
- Validates returning heartbeats with shared mesh key.
- Reports failures to Shield via `mesh_report.sh`.
- Triggers `hello --verify-mesh` re-validation on 3 consecutive missed heartbeats.

**Usage:** `mesh_heartbeat.sh --peers <peer-list-file> --key <mesh-key-file>`

**Dependencies:** `openssl`, `curl`, `sysd-engine` (HbMgr)

---

#### mesh_report.sh

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `/opt/apache/tools/mesh_report.sh`                           |
| **Type**        | Bash script                                                  |
| **Purpose**     | Mesh status reporting — aggregates and reports node status to Shield |
| **Nodes**       | All nodes                                                    |
| **Permissions** | `root:root`, `0750`                                          |

**Behavior:**
- Collects node health, service status, firewall state, and heartbeat data.
- Formats as JSON and sends to Shield dashboard API.
- Runs on-demand or via `s3rv1c3agent` trigger.

**Usage:** `mesh_report.sh [--full|--summary]`

**Dependencies:** `mesh_heartbeat.sh`, `svcbeat`, `curl`, `jq`

---

### 2.6 PHP API Handlers (Public Site)

All located under the public web root (e.g., `/var/www/html/` or `/opt/apache/htdocs/`).
All are PHP scripts executed via `php-fpm` behind nginx.

#### api/index.php

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `api/index.php`                                              |
| **Type**        | PHP script (API entry point)                                 |
| **Purpose**     | Central API gateway — request routing, auth, rate limiting   |
| **Rate Limits** | 100 req/min general, 5 req/min login                         |
| **Nodes**       | Origin                                                       |

**Behavior:**
- All API traffic enters through this file.
- Applies rate limiting buckets before routing.
- Validates API keys or session tokens.
- Dispatches to handler scripts via `router.php`.

**Dependencies:** `core/auth_chain.php`, `core/rbac.php`, `core/csrf.php`, `api/router.php`

---

#### api/router.php

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `api/router.php`                                             |
| **Type**        | PHP script                                                   |
| **Purpose**     | SPA route handler — maps URL paths to handler files          |
| **Nodes**       | Origin                                                       |

**Security:** Uses `basename()` on all file inclusions to prevent LFI (Local File Inclusion).

**Handler dispatch table:**

| Route         | Handler File             |
|---------------|--------------------------|
| `/account`    | `api/handlers/account.php` |
| `/auth`       | `api/handlers/auth.php`    |
| `/callback`   | `api/handlers/callback.php`|
| `/checkout`   | `api/handlers/checkout.php`|
| `/order`      | `api/handlers/order.php`   |
| `/page`       | `api/handlers/page.php`    |
| `/product`    | `api/handlers/product.php` |
| `/render`     | `api/handlers/render.php`  |
| `/review`     | `api/handlers/review.php`  |
| `/security`   | `api/handlers/security.php`|
| `/support`    | `api/handlers/support.php` |
| `/telemetry`  | `api/handlers/telemetry.php`|
| `/trust`      | `api/handlers/trust.php`   |

**Dependencies:** `api/index.php`

---

#### api/purchase-bridge.php

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `api/purchase-bridge.php`                                    |
| **Type**        | PHP script                                                   |
| **Purpose**     | Payment bridge — proxies purchase requests to engine/port 8301 |
| **Nodes**       | Origin                                                       |

**Dependencies:** `core/payment_client.php`, `sysd-engine`

---

#### api/support-bridge.php

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `api/support-bridge.php`                                     |
| **Type**        | PHP script                                                   |
| **Purpose**     | Support ticket bridge — forwards tickets to Shield support system |
| **Nodes**       | Origin                                                       |

**Dependencies:** `core/shield_relay.php`

---

#### API Handler Scripts

| Handler     | File                            | Purpose                              |
|-------------|----------------------------------|--------------------------------------|
| account     | `api/handlers/account.php`       | User account CRUD                    |
| auth        | `api/handlers/auth.php`          | Login, logout, session management    |
| callback    | `api/handlers/callback.php`      | External service callbacks (webhooks)|
| checkout    | `api/handlers/checkout.php`      | Checkout flow coordination           |
| order       | `api/handlers/order.php`         | Order management and history         |
| page        | `api/handlers/page.php`          | CMS page content delivery            |
| product     | `api/handlers/product.php`       | Product catalog and search           |
| render      | `api/handlers/render.php`        | Template/rendering engine            |
| review      | `api/handlers/review.php`        | Product review system                |
| security    | `api/handlers/security.php`      | Security settings and audit view     |
| support     | `api/handlers/support.php`       | Support ticket submission            |
| telemetry   | `api/handlers/telemetry.php`     | Client-side telemetry collection     |
| trust       | `api/handlers/trust.php`         | Trust score and verification         |

**All handlers depend on:** `core/database.php`, `core/csrf.php`, `core/events.php`

---

### 2.7 PHP Dashboard Core

All located in `core/` directory. All are PHP classes/libraries.

#### core/payment_client.php

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `core/payment_client.php`                                    |
| **Type**        | PHP class                                                    |
| **Purpose**     | PaymentServerClient — encrypts payment data for engine       |
| **Encryption**  | `sodium_crypto_box` (NaCl/libsodium)                         |
| **Nodes**       | Origin, Payment                                              |

**Dependencies:** `libsodium` PHP extension

---

#### core/shield_relay.php

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `core/shield_relay.php`                                      |
| **Type**        | PHP class                                                    |
| **Purpose**     | SSH relay to spoke nodes — fleet command IPC channel         |
| **Nodes**       | Shield                                                       |

**Dependencies:** `ssh2` PHP extension (or `exec` with pre-configured SSH keys)

---

#### core/fleet_orchestrator.php

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `core/fleet_orchestrator.php`                                |
| **Type**        | PHP class                                                    |
| **Purpose**     | Fleet management — coordinates all mesh nodes as a fleet     |
| **Nodes**       | Shield                                                       |

**Dependencies:** `core/shield_relay.php`, `core/database.php`

---

#### core/auth_chain.php

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `core/auth_chain.php`                                        |
| **Type**        | PHP class                                                    |
| **Purpose**     | 3-phase admin authentication chain                           |
| **Phases**      | PIN (600s window) > Password (300s window) > Tokens (300s window) |
| **Nodes**       | Shield, Origin                                               |

**Dependencies:** `core/database.php`, `security/pin_generator.php`, `security/secondary_token.php`

---

#### core/rbac.php

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `core/rbac.php`                                              |
| **Type**        | PHP class                                                    |
| **Purpose**     | Role-based access control with 40+ permission definitions    |
| **Nodes**       | Shield, Origin                                               |

**Dependencies:** `core/database.php`, `security/rbac.php`

---

#### core/csrf.php

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `core/csrf.php`                                              |
| **Type**        | PHP class                                                    |
| **Purpose**     | CSRF token generation and validation                         |
| **Nodes**       | All (Origin, Shield, Payment)                                |

**Dependencies:** `PHP session`, `openssl`

---

#### core/crypto_fields.php

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `core/crypto_fields.php`                                     |
| **Type**        | PHP class                                                    |
| **Purpose**     | Encrypted field management — transparent encrypt/decrypt for DB columns |
| **Nodes**       | Shield, Origin, Payment                                      |

**Dependencies:** `openssl` PHP extension

---

#### core/database.php

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `core/database.php`                                          |
| **Type**        | PHP class                                                    |
| **Purpose**     | Database abstraction layer (PDO wrapper)                     |
| **Nodes**       | All                                                          |

**Dependencies:** `PDO`, `PDO_MySQL` (or `PDO_SQLite` for local)

---

#### core/events.php

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `core/events.php`                                            |
| **Type**        | PHP class                                                    |
| **Purpose**     | Event logging — structured security and audit events         |
| **Nodes**       | All                                                          |

**Dependencies:** `core/database.php`

---

### 2.8 Security Systems

All located in `security/` directory. PHP classes and scripts.

#### security/auth_chain.php

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `security/auth_chain.php`                                    |
| **Type**        | PHP class                                                    |
| **Purpose**     | 3-phase authentication chain                                 |
| **Phase 1**     | PIN validation (600-second window)                           |
| **Phase 2**     | Password validation (300-second window)                      |
| **Phase 3**     | Secondary token validation (300-second window)               |
| **Nodes**       | Shield, Origin                                               |

**Dependencies:** `security/pin_generator.php`, `security/secondary_token.php`

---

#### security/rbac.php

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `security/rbac.php`                                          |
| **Type**        | PHP class                                                    |
| **Purpose**     | Role-based access control hierarchy                          |

**Role Hierarchy:**

| Role       | Level | Description                    |
|------------|-------|--------------------------------|
| viewer     | 1     | Read-only dashboard access     |
| operator   | 2     | Operational commands allowed   |
| admin      | 3     | Full admin access              |
| owner      | 4     | Account ownership              |
| superadmin | 99    | Infrastructure-level access    |

**Permissions:** 40+ granular permissions mapped to roles.

**Dependencies:** `core/database.php`

---

#### security/csrf.php

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `security/csrf.php`                                          |
| **Type**        | PHP class                                                    |
| **Purpose**     | CSRF token generation, embedding, and validation             |
| **Nodes**       | All                                                          |

**Dependencies:** `PHP session`, `openssl`

---

#### security/audit_logger.php

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `security/audit_logger.php`                                  |
| **Type**        | PHP class                                                    |
| **Purpose**     | Security event audit logging — immutable log entries         |
| **Nodes**       | Shield                                                       |

**Dependencies:** `core/database.php`, `core/events.php`

---

#### security/obfuscator.php

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `security/obfuscator.php`                                    |
| **Type**        | PHP class                                                    |
| **Purpose**     | DOM obfuscation engine — protects frontend code/structure    |
| **Nodes**       | Origin                                                       |

**Dependencies:** None (pure PHP)

---

#### security/pin_generator.php

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `security/pin_generator.php`                                 |
| **Type**        | PHP class                                                    |
| **Purpose**     | Generates cryptographically secure admin PINs                |
| **Nodes**       | Shield                                                       |

**Dependencies:** `random_bytes()` (PHP 7+), `openssl`

---

#### security/request_signer.php

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `security/request_signer.php`                                |
| **Type**        | PHP class                                                    |
| **Purpose**     | HMAC request signing for inter-service API calls             |
| **Nodes**       | All                                                          |

**Dependencies:** `hash_hmac()`, `openssl`

---

#### security/secondary_token.php

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `security/secondary_token.php`                               |
| **Type**        | PHP class                                                    |
| **Purpose**     | Phase 3 token management — time-limited secondary auth tokens |
| **Nodes**       | Shield, Origin                                               |

**Dependencies:** `openssl`, `core/database.php`

---

### 2.9 Ghost Tools (Encrypted)

**WARNING:** These tools are AES-256-CBC encrypted at rest. They are decrypted and
executed in memory only. Never present as plaintext on disk.

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Shield Path** | `/opt/ghost/tools/`                                          |
| **Payment Path**| `/opt/ghost/tools/`                                          |
| **Origin Path** | `/var/lib/php/opcache/.jit/`                                 |
| **Encryption**  | AES-256-CBC, 32-character hexadecimal IV                     |
| **Decryptor**   | `nginx-maint.sh`                                             |
| **Runner Hash** | `/opt/ghost/.runner_hash`                                    |

**Decryption / Execution Chain:**
1. `nginx-maint.sh` reads encrypted tool file
2. Decrypts with AES-256-CBC using runtime-derived key
3. Executes decrypted payload in a subshell (`bash -c`)
4. Runs `shred -u` on any temporary decrypted files
5. Verifies execution integrity against `.runner_hash`

**Tool Categories:**

| Category    | Purpose                                           | Examples                            |
|-------------|---------------------------------------------------|--------------------------------------|
| blackhole   | Traffic sinkhole / honeypot operations            | blackhole-route, blackhole-log      |
| dns         | DNS manipulation and monitoring                   | dns-spoof, dns-monitor              |
| integrity   | File integrity verification                       | integrity-check, integrity-report   |
| kernel      | Kernel-level operations                           | kernel-module, kernel-harden        |
| network     | Network reconnaissance and manipulation           | network-scan, network-isolate       |
| ping        | Advanced ping / probe tools                       | ping-mesh, ping-covert              |
| probe       | System probing and data collection                | probe-services, probe-filesystem    |
| service     | Service manipulation (start/stop/inject)          | service-inject, service-hide        |
| wg-status   | WireGuard tunnel status and management            | wg-status, wg-rotate                |

**Nodes:** Shield, Payment, Origin (each node has a subset)
**Permissions:** `root:root`, `0700`

---

### 2.10 Wallet Services

All are Python daemons on the **Payment node**.

#### Monero (XMR) Watcher

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `/opt/wallets/xmr/watcher.py`                                |
| **Type**        | Python daemon                                                |
| **Purpose**     | Monero wallet monitor — watches for incoming XMR transactions |
| **Listen Port** | 8901                                                         |
| **Auth**        | HMAC (`X-Wallet-Sig`, `X-Wallet-Ts` headers)                 |
| **Node**        | Payment                                                      |

**API Endpoints (port 8901):**
- `/balance` — Current XMR balance
- `/transactions` — Recent transaction list
- `/watch` — Subscribe address for notifications
- `/confirm` — Check confirmation count for txid

**Dependencies:** `monero-python`, `requests`, `flask` (or `fastapi`)

---

#### USDT (TRC20) Watcher

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `/opt/wallets/usdt/watcher.py`                               |
| **Type**        | Python daemon                                                |
| **Purpose**     | USDT TRC20 wallet monitor — watches TRON network for USDT    |
| **Listen Port** | 8902                                                         |
| **Auth**        | HMAC (`X-Wallet-Sig`, `X-Wallet-Ts` headers)                 |
| **Node**        | Payment                                                      |

**API Endpoints (port 8902):**
- `/balance` — Current USDT balance
- `/transactions` — TRC20 transfer list
- `/watch` — Subscribe TRON address
- `/confirm` — Check confirmation status

**Dependencies:** `tronpy`, `requests`, `flask`

---

#### USDC (ERC20) Watcher

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `/opt/wallets/usdc/watcher.py`                               |
| **Type**        | Python daemon                                                |
| **Purpose**     | USDC ERC20 wallet monitor — watches Ethereum for USDC        |
| **Listen Port** | 8903                                                         |
| **Auth**        | HMAC (`X-Wallet-Sig`, `X-Wallet-Ts` headers)                 |
| **Node**        | Payment                                                      |

**API Endpoints (port 8903):**
- `/balance` — Current USDC balance
- `/transactions` — ERC20 transfer list
- `/watch` — Subscribe Ethereum address
- `/confirm` — Check confirmation count

**Dependencies:** `web3.py`, `requests`, `flask`

---

### 2.11 Vault System

Located on the **Payment node**. Bash scripts and encrypted `.vault` files.

#### securevault.sh

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `/opt/ghost/tools/securevault.sh`                            |
| **Type**        | Bash script                                                  |
| **Purpose**     | Encrypt/decrypt CLI tool for vault files                     |
| **Node**        | Payment                                                      |
| **Permissions** | `root:root`, `0700`                                          |

**Usage:**
```bash
securevault.sh encrypt --file <plaintext> --vault <name.vault>
securevault.sh decrypt --vault <name.vault> --output <plaintext>
securevault.sh list    # Show all vault files and metadata
```

**Dependencies:** `openssl`, `fetch-vault-key.sh`

---

#### fetch-vault-key.sh

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Full Path**   | `/opt/ghost/tools/fetch-vault-key.sh`                        |
| **Type**        | Bash script                                                  |
| **Purpose**     | Runtime key fetch — retrieves decryption key from Shield     |
| **Node**        | Payment                                                      |
| **Permissions** | `root:root`, `0700`                                          |

**Behavior:**
- Authenticates to Shield key server via HMAC-signed request.
- Retrieves ephemeral decryption key (never stored locally in plaintext).
- Keys are held in memory only and cleared after vault operation.

**Dependencies:** `openssl`, `curl`

---

#### Vault Files (`.vault`)

| Vault File     | Contents                                   | Sensitivity |
|----------------|-------------------------------------------|-------------|
| `stripe.vault` | Stripe API keys and webhook secrets       | Critical    |
| `tron.vault`   | TRON private keys for USDT TRC20          | Critical    |
| `xmr.vault`    | Monero wallet credentials and view keys   | Critical    |
| `origin_mysql.vault` | Origin node MySQL credentials         | High        |
| `gmail.vault`  | Gmail SMTP / API credentials              | High        |
| (6 additional) | Other service credentials and keys        | High        |

**Total:** 11 `.vault` files
**Storage:** `/opt/ghost/vaults/` — `root:root`, `0700`

---

### 2.12 systemd Services

#### sysd-engine.service

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Unit File**   | `/etc/systemd/system/sysd-engine.service`                    |
| **Type**        | systemd service unit                                         |
| **Exec**        | `/usr/local/sbin/sysd-engine`                                |
| **Purpose**     | Engine daemon — core mesh node process                       |
| **Nodes**       | All nodes                                                    |

**Security Hardening:**
```ini
NoNewPrivileges=true
ProtectSystem=strict
PrivateTmp=true
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_NET_ADMIN
```

---

#### n6-apache-tools.service

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Unit File**   | `/etc/systemd/system/n6-apache-tools.service`                |
| **Type**        | systemd service unit                                         |
| **Purpose**     | Apache tools service — keeps mail tools and svc* available   |
| **Nodes**       | All nodes                                                    |

---

#### php-opcache-gc.service

| Field           | Value                                                        |
|-----------------|--------------------------------------------------------------|
| **Unit File**   | `/etc/systemd/system/php-opcache-gc.service`                 |
| **Type**        | systemd service unit                                         |
| **Purpose**     | **DISGUISED** — Fleet relay / ghost tool runner (camouflage) |
| **Disguise**    | Appears as PHP OPcache garbage collection                     |
| **Actual Func** | Decrypts and executes ghost tools, maintains fleet relay     |
| **Nodes**       | Origin, Shield                                               |

**Behavior:**
- Unit name and description mimic benign PHP maintenance.
- Actual function is fleet relay command and control.
- May trigger `nginx-maint.sh` for ghost tool decryption.

---

### 2.13 Nginx Configurations

Configuration files are node-specific. Organized by functional category.

#### Proxy Configs

| File                  | Path (typical)                  | Purpose                          | Nodes       |
|-----------------------|----------------------------------|----------------------------------|-------------|
| `gateway.conf`        | `/etc/nginx/conf.d/`            | Main reverse proxy / gateway      | All         |
| `blackhole.conf`      | `/etc/nginx/conf.d/`            | Traffic sinkhole routing          | Shield      |
| `mode.conf`           | `/etc/nginx/conf.d/`            | Operating mode selector           | All         |

#### Filter / WAF Configs

| File                  | Path (typical)                  | Purpose                          | Nodes       |
|-----------------------|----------------------------------|----------------------------------|-------------|
| `waf.conf`            | `/etc/nginx/conf.d/`            | Web application firewall rules    | All         |
| `blacklist.conf`      | `/etc/nginx/conf.d/`            | IP and UA blacklist               | All         |
| `ghost-protocol.conf` | `/etc/nginx/conf.d/`            | Ghost tool protocol handler       | Shield      |
| `listen-8380.conf`    | `/etc/nginx/conf.d/`            | Listener on port 8380 (alt API)   | Shield      |

#### Shield Node Configs

| File                  | Path (typical)                  | Purpose                          |
|-----------------------|----------------------------------|----------------------------------|
| `relay.conf`          | `/etc/nginx/conf.d/`            | SSH/fleet relay proxy            |
| `dashboard.conf`      | `/etc/nginx/conf.d/`            | Admin dashboard vhost            |
| `mail-api.conf`       | `/etc/nginx/conf.d/`            | Mail API endpoint                |
| `php-fpm.conf`        | `/etc/nginx/conf.d/`            | PHP-FPM upstream                 |

#### Origin Node Configs

| File                  | Path (typical)                  | Purpose                          |
|-----------------------|----------------------------------|----------------------------------|
| `storefront.conf`     | `/etc/nginx/conf.d/`            | Public storefront vhost          |
| `dashboard.conf`      | `/etc/nginx/conf.d/`            | Customer dashboard vhost         |
| `php-fpm.conf`        | `/etc/nginx/conf.d/`            | PHP-FPM upstream                 |

#### Payment Node Configs

| File                  | Path (typical)                  | Purpose                          |
|-----------------------|----------------------------------|----------------------------------|
| `bridge.conf`         | `/etc/nginx/conf.d/`            | Payment bridge proxy             |
| `suppliments.conf`    | `/etc/nginx/conf.d/`            | Supplement node proxy            |
| `php-fpm.conf`        | `/etc/nginx/conf.d/`            | PHP-FPM upstream                 |

---

## 3. Dependency Graph

```
sysd-engine (port 8301)
  |
  |-- HbMgr --> mesh_heartbeat.sh --> mesh_report.sh
  |-- WdMgr --> svcbeat --> svcboot
  |-- DdMon --> svcfw
  |-- FoMgr --> mesh_report.sh
  |-- ScMgr --> s3rv1c3agent
  |-- FwMgr --> svcfw
  |-- LdMgr --> (all tools on lockdown trigger)

hello
  |
  |-- Phase 1: --verify-mesh --> mesh_heartbeat.sh
  |-- Phase 2: --load-routes --> svcfw, svccfg
  |-- Phase 3: --start-engine --> sysd-engine.service
  |
  +-- Failure at any phase --> LdMgr lockdown

s3rv1c3agent
  |
  |-- heartbeat --> Shield
  |-- command execution --> askmail, cmdmail, dbwrite, getmail, logmail
  |                       paymail, pollmail, unmail
  |-- every 10s --> img-pipeline.sh
  |-- depends on --> hello (terminates on hello failure - Rule 4)

mail tools (8+)
  |
  +-- all source --> se_client.sh
  +-- mailctl daemon --> HMAC validation, constant_time_equal

se_client.sh
  |
  +-- provides: hmac_sign(), api_call(), log_event(), read_config()

PHP API (Origin)
  |
  |-- api/index.php --> api/router.php
  |                   --> core/rbac.php
  |                   --> core/csrf.php
  |                   --> core/auth_chain.php
  |
  |-- api/purchase-bridge.php --> core/payment_client.php --> sysd-engine
  |-- api/support-bridge.php --> core/shield_relay.php

PHP Dashboard (Shield)
  |
  |-- core/fleet_orchestrator.php --> core/shield_relay.php
  |                               --> core/database.php
  |-- core/auth_chain.php --> security/auth_chain.php
  |                         --> security/pin_generator.php
  |                         --> security/secondary_token.php

Security
  |
  |-- security/auth_chain.php --> security/pin_generator.php
  |                             --> security/secondary_token.php
  |-- security/audit_logger.php --> core/events.php
  |-- security/request_signer.php --> HMAC for all inter-service calls
  |-- security/csrf.php --> all API handlers, all dashboard pages

Ghost Tools
  |
  |-- encrypted at rest --> decrypted by nginx-maint.sh
  |-- execution --> shred -u cleanup
  |-- integrity --> .runner_hash verification
  |-- trigger --> php-opcache-gc.service (camouflaged)

Vault (Payment)
  |
  |-- securevault.sh --> fetch-vault-key.sh --> Shield key server
  |-- decrypts --> 11 .vault files

Wallet Watchers (Payment)
  |
  |-- xmr/watcher.py (port 8901) --> monero daemon
  |-- usdt/watcher.py (port 8902) --> tron node/API
  |-- usdc/watcher.py (port 8903) --> ethereum node/API
  |-- all use HMAC auth (X-Wallet-Sig, X-Wallet-Ts)
```

---

## 4. Execution Chain

### Primary Startup Sequence (All Nodes)

```
[BOOT]
  |
  v
[hello --verify-mesh]        Phase 1: Mesh verification
  |                           - Validates node identity
  |                           - Checks peer connectivity
  |                           - Failure => HARD LOCKDOWN (Rule 3)
  v
[hello --load-routes]        Phase 2: Route and firewall setup
  |                           - Applies routing tables
  |                           - Loads firewall baseline (svcfw)
  |                           - Configures service parameters (svccfg)
  |                           - Failure => HARD LOCKDOWN (Rule 3)
  v
[hello --start-engine]       Phase 3: Engine start
  |                           - systemctl start sysd-engine.service
  |                           - Engine initializes all subsystems
  |                           - Opens HTTP API on 0.0.0.0:8301
  |                           - Failure => HARD LOCKDOWN (Rule 3)
  v
[sysd-engine running]
  |
  +-- [HbMgr] --> mesh_heartbeat.sh --> continuous peer heartbeats
  |
  +-- [WdMgr] --> subsystem health monitoring
  |
  +-- [ScMgr] --> s3rv1c3agent startup
  |                 |
  |                 v
  |               [s3rv1c3agent running]
  |                 |
  |                 +-- Heartbeat to Shield
  |                 +-- Whitelisted command execution
  |                 +-- Every 10s: img-pipeline.sh
  |                 +-- On hello failure: IMMEDIATE TERMINATE (Rule 4)
  |
  +-- [DdMon] --> DDoS monitoring active
  |
  +-- [FwMgr] --> Dynamic firewall management
  |
  +-- [FoMgr] --> Failover coordination
  |
  +-- [LdMgr] --> Lockdown on breach (isolates node)
```

### Mail Tool Execution Chain

```
[Shield command] or [local trigger]
  |
  v
[s3rv1c3agent receives command]
  |
  v
[HMAC validation]  --FAIL-->  [discard, log, alert]
  |
  v
[case statement dispatch]
  |
  +-- mail query --> askmail --> se_client.sh --> Shield mail API
  +-- mail command --> cmdmail --> {askmail, getmail, logmail, ...}
  +-- mail retrieve --> getmail --> se_client.sh --> mail queue
  +-- mail log --> logmail --> dbwrite --> database
  +-- payment notify --> paymail --> se_client.sh --> payment API
  +-- mail poll --> pollmail --> external mail source
  +-- mail undo --> unmail --> dbwrite --> database
  +-- mail control --> mailctl daemon --> HMAC validation --> queue ops
```

### Ghost Tool Execution Chain

```
[php-opcache-gc.service triggered] or [nginx-maint.sh invoked]
  |
  v
[nginx-maint.sh]
  |
  +-- Reads encrypted tool from /opt/ghost/tools/ or /var/lib/php/opcache/.jit/
  +-- Fetches decryption key
  |
  v
[AES-256-CBC decryption]
  |
  v
[Verify against /opt/ghost/.runner_hash]
  |    --MISMATCH--> [abort, alert Shield]
  |
  v
[Execute decrypted payload in subshell]
  |
  v
[shred -u cleanup of all temporary files]
  |
  v
[Log execution to Shield audit]
```

### Wallet Transaction Flow

```
[Customer payment]
  |
  v
[Origin storefront]
  |
  v
[api/purchase-bridge.php] --> [core/payment_client.php (NaCl encrypt)]
  |
  v
[sysd-engine port 8301] --> [Payment node]
  |
  +-- XMR path --> /opt/wallets/xmr/watcher.py:8901 --> Monero network
  +-- USDT path --> /opt/wallets/usdt/watcher.py:8902 --> TRON network
  +-- USDC path --> /opt/wallets/usdc/watcher.py:8903 --> Ethereum network
  |
  v
[Watcher confirms transaction] --> HMAC callback to engine --> DB update
  |
  v
[paymail notification] --> customer email
```

---

## 5. Quick Reference Table

| # | Tool | Path | Type | Node | Port |
|---|------|------|------|------|------|
| 1 | sysd-engine | `/usr/local/sbin/sysd-engine` | Binary | All | 8301 |
| 2 | hello | `/opt/apache/tools/hello` | Bash | All | — |
| 3 | s3rv1c3agent | `/opt/apache/tools/s3rv1c3agent` | Bash | All | — |
| 4 | img-pipeline.sh | `/opt/apache/tools/img-pipeline.sh` | Bash | All | — |
| 5 | se_client.sh | `/opt/apache/tools/se_client.sh` | Bash lib | All | — |
| 6 | askmail | `/opt/apache/tools/askmail` | Bash | All | — |
| 7 | cmdmail | `/opt/apache/tools/cmdmail` | Bash | All | — |
| 8 | dbwrite | `/opt/apache/tools/dbwrite` | Bash | All | — |
| 9 | getmail | `/opt/apache/tools/getmail` | Bash | All | — |
| 10 | logmail | `/opt/apache/tools/logmail` | Bash | All | — |
| 11 | mailcli | `/opt/apache/tools/mailcli` | Bash | Shield, Origin | — |
| 12 | mailctl | `/opt/apache/tools/mailctl` | Bash | Shield, Origin | — |
| 13 | paymail | `/opt/apache/tools/paymail` | Bash | Payment, Shield | — |
| 14 | pollmail | `/opt/apache/tools/pollmail` | Bash | Shield, Origin | — |
| 15 | unmail | `/opt/apache/tools/unmail` | Bash | All | — |
| 16 | svcbeat | `/opt/apache/tools/svcbeat` | Bash | All | — |
| 17 | svcboot | `/opt/apache/tools/svcboot` | Bash | All | — |
| 18 | svccfg | `/opt/apache/tools/svccfg` | Bash | All | — |
| 19 | svcfile | `/opt/apache/tools/svcfile` | Bash | All | — |
| 20 | svcfw | `/opt/apache/tools/svcfw` | Bash | All | — |
| 21 | svclock | `/opt/apache/tools/svclock` | Bash | All | — |
| 22 | svclog | `/opt/apache/tools/svclog` | Bash | All | — |
| 23 | svcpass | `/opt/apache/tools/svcpass` | Bash | All | — |
| 24 | svcperm | `/opt/apache/tools/svcperm` | Bash | All | — |
| 25 | svcrotate | `/opt/apache/tools/svcrotate` | Bash | All | — |
| 26 | svctrap | `/opt/apache/tools/svctrap` | Bash | All | — |
| 27 | mesh_heartbeat.sh | `/opt/apache/tools/mesh_heartbeat.sh` | Bash | All | — |
| 28 | mesh_report.sh | `/opt/apache/tools/mesh_report.sh` | Bash | All | — |
| 29 | api/index.php | `api/index.php` | PHP | Origin | 80/443 |
| 30 | api/router.php | `api/router.php` | PHP | Origin | 80/443 |
| 31 | api/purchase-bridge.php | `api/purchase-bridge.php` | PHP | Origin | 80/443 |
| 32 | api/support-bridge.php | `api/support-bridge.php` | PHP | Origin | 80/443 |
| 33 | core/payment_client.php | `core/payment_client.php` | PHP | Origin, Payment | — |
| 34 | core/shield_relay.php | `core/shield_relay.php` | PHP | Shield | — |
| 35 | core/fleet_orchestrator.php | `core/fleet_orchestrator.php` | PHP | Shield | — |
| 36 | core/auth_chain.php | `core/auth_chain.php` | PHP | Shield, Origin | — |
| 37 | core/rbac.php | `core/rbac.php` | PHP | Shield, Origin | — |
| 38 | core/csrf.php | `core/csrf.php` | PHP | All | — |
| 39 | core/crypto_fields.php | `core/crypto_fields.php` | PHP | All | — |
| 40 | core/database.php | `core/database.php` | PHP | All | — |
| 41 | core/events.php | `core/events.php` | PHP | All | — |
| 42 | security/auth_chain.php | `security/auth_chain.php` | PHP | Shield, Origin | — |
| 43 | security/rbac.php | `security/rbac.php` | PHP | Shield, Origin | — |
| 44 | security/csrf.php | `security/csrf.php` | PHP | All | — |
| 45 | security/audit_logger.php | `security/audit_logger.php` | PHP | Shield | — |
| 46 | security/obfuscator.php | `security/obfuscator.php` | PHP | Origin | — |
| 47 | security/pin_generator.php | `security/pin_generator.php` | PHP | Shield | — |
| 48 | security/request_signer.php | `security/request_signer.php` | PHP | All | — |
| 49 | security/secondary_token.php | `security/secondary_token.php` | PHP | Shield, Origin | — |
| 50 | Ghost tools | `/opt/ghost/tools/` or `/var/lib/php/opcache/.jit/` | Encrypted | Shield, Payment, Origin | — |
| 51 | nginx-maint.sh | (with Ghost tools) | Bash | Shield, Origin | — |
| 52 | xmr/watcher.py | `/opt/wallets/xmr/watcher.py` | Python | Payment | 8901 |
| 53 | usdt/watcher.py | `/opt/wallets/usdt/watcher.py` | Python | Payment | 8902 |
| 54 | usdc/watcher.py | `/opt/wallets/usdc/watcher.py` | Python | Payment | 8903 |
| 55 | securevault.sh | `/opt/ghost/tools/securevault.sh` | Bash | Payment | — |
| 56 | fetch-vault-key.sh | `/opt/ghost/tools/fetch-vault-key.sh` | Bash | Payment | — |
| 57 | sysd-engine.service | `/etc/systemd/system/sysd-engine.service` | systemd | All | — |
| 58 | n6-apache-tools.service | `/etc/systemd/system/n6-apache-tools.service` | systemd | All | — |
| 59 | php-opcache-gc.service | `/etc/systemd/system/php-opcache-gc.service` | systemd | Shield, Origin | — |
| 60 | Nginx configs | `/etc/nginx/conf.d/*.conf` | Config | All | 80/443/8380 |

---

## 6. Security Notes

### HMAC Authentication

Every inter-node and inter-service communication uses HMAC-SHA256 authentication.
Timing-safe comparison (`constant_time_equal`) is mandatory for all HMAC validations.
No exceptions.

### Lockdown Rules

| Rule | Trigger | Action |
|------|---------|--------|
| Rule 3 | Any `hello` phase failure | Hard lockdown via LdMgr — node isolation |
| Rule 4 | `hello` failure detected by agent | `s3rv1c3agent` immediate termination |

### Ghost Tool Security

- AES-256-CBC encryption with 32-character hex IV
- Decrypted only in memory, never written to persistent storage unencrypted
- `shred -u` ensures secure cleanup of temporary decrypted data
- `.runner_hash` integrity verification prevents tampered execution

### Wallet Authentication

All three wallet watchers use HMAC authentication:
- Header: `X-Wallet-Sig` — HMAC-SHA256 signature
- Header: `X-Wallet-Ts` — Unix timestamp (replay protection)
- Requests with timestamps older than 60 seconds are rejected

### Vault Security

- Encryption keys are never stored on the Payment node
- `fetch-vault-key.sh` retrieves ephemeral keys from Shield at runtime
- Keys exist in process memory only and are zeroed after use
- 11 vault files cover all sensitive credentials

### PHP Security

- `basename()` enforcement on all file inclusions (LFI prevention)
- Rate limiting: 100 req/min general, 5 req/min login
- CSRF tokens on all state-changing operations
- NaCl `sodium_crypto_box` for payment data encryption
- 3-phase auth chain with time-bounded windows prevents brute force

---

*End of Tool Map*

